There are numerous opportunities for future work with $R$.  We list a few of them here.
\begin{enumerate}
\item \textit{Null-byte elimination.}  Tables \ref{table:gadget_data} and \ref{table:gadget_data_libc} show a huge frequency of null bytes, mostly due to small word-sized numbers inlined in our payload.  Our payload is consequently incompatible with C-string based input vectors such as \texttt{strcpy}.
\item \textit{Conditional jumps.}  This will be another step toward Turing-complete payloads.  Schacham gave a description of how conditional jumps may be performed \cite{schacham}, though Schwartz et. al. noted an general lack of the arithmetic gadgets necessary to evaluate conditions \cite{schwartz}.  We note that our payload description language is rich enough to encode these behaviors.
\item \textit{Tolerance of stack increments.} We specify exactly the desired change in \texttt{\%esp} in our instructions.  This causes us to miss gadgets which harmlessly pop values into unused registers before returning.
\end{enumerate}
